Shared responsibility
Learn which parts of security Bulutistan Cloud takes care of, and which parts you own, from access and networking to the software and data in your instances.
Security in Bulutistan Cloud is a shared responsibility. Bulutistan secures the facilities, the cloud, and the platform that you manage your resources with. You secure what you build and keep on the platform: who can access it, how your instances and networks are configured, and how your data is protected.
Responsibilities at a glance
| Area | Bulutistan Cloud | You |
|---|---|---|
| Facilities and hardware | Runs the facilities and the cloud of the regions that your resources run in, such as Istanbul 1. | — |
| Access to the platform | Authenticates every API request, and enforces the roles, token scopes, IP allowlists, and two-factor requirement that you set. | Decide who gets which role, require two-factor authentication, and remove people who leave. |
| Separation between customers | Keeps each tenant's resources and records apart. | — |
| Credentials | Shows the secrets of API tokens and keys once, and checks credentials on every request. | Store secrets safely, give them short lifetimes, and revoke them when they might have leaked. |
| Network | Applies the security group rules that you define to the traffic of your instances. | Write the rules, and decide which instances get public addresses. |
| Instances | Starts instances from the image that you choose, with the SSH keys, admin account, and user data that you set. | Keep the operating system and the software inside up to date, and manage the accounts on it. |
| Data | Stores your volumes, snapshots, backups, and objects in the region of their project, and the console and the REST API refuse to delete instances and volumes that have deletion protection. | Assign volumes to backup plans, turn on deletion protection, and encrypt data that must be encrypted at rest. |
| Audit | Records the operations listed in Audit and activity records, with the actor, the time, and the result. | Review the records, and export the ones that you need to keep. |
What Bulutistan Cloud is responsible for
Facilities and the cloud. Bulutistan runs the facilities and the OpenStack cloud of the regions that your platform offers. Istanbul 1, for example, runs in Bulutistan data centers in Türkiye.
Access control. Every API request passes an API gateway that identifies the caller and checks the caller's access to the project. When it can't check, it refuses the request. The platform enforces the roles that you grant, the scopes and IP allowlists of API tokens, and the two-factor requirement for existing members.
Separation between customers. Each of your projects is a separate project in the region's cloud. In the platform's database, row-level security keeps each tenant's records apart, and a request for a project that you can't access is answered as if the project didn't exist.
Credentials. The secret of an API token or a service account key is shown once. Because the platform checks bearer credentials on every request, revoking a token takes effect on its next request. The browser console of an instance opens with a ticket that works once and expires after 60 seconds.
Your protection settings. When you turn on deletion protection for an instance or a volume, the console and the REST API refuse to delete it until you turn the protection off.
What you're responsible for
Identity and access. Grant each member the narrowest role at the narrowest scope that does the job. Require two-factor authentication for existing members with Enforce 2FA for all members. When someone leaves, remove them: their API tokens are revoked when you do.
Credentials. Keep API tokens, service account keys, and application credentials out of code and version control. Give API tokens and application credentials expiry dates, and restrict API tokens to the scopes and source addresses that they need. A service account key always expires after 365 days, so replace it before then. Revoke any credential that might have leaked.
Network exposure. Security groups decide which traffic reaches your instances. Open only the ports that your workloads need, from the narrowest source ranges, and give a public address only to the instances that need one.
The inside of your instances. Your SSH keys and the admin account that you set up are added when the instance first boots, and user data runs on the first boot only. After that, the operating system, its updates, its accounts, and the software and data on it are yours to manage.
Data protection. Backup Center backs up only the volumes that you assign to a backup plan. Choose which volumes to protect, and keep deletion protection on for the ones that you can't lose. For data that must be encrypted at rest, encrypt it yourself, for example in the instance's operating system or before you upload objects. See Encryption.
Monitoring and response. Review the Activity Log, and set up alert rules for the resources that matter to you.
Example
You run a web application on an instance with a data volume:
- Bulutistan keeps the data center, the cloud, and the platform's access control running and secure.
- You choose the image and keep the web server software updated, allow only ports 80 and 443 from the internet in the instance's security group, and give your team members roles that match their work.
- You assign the data volume to a backup plan, turn on deletion protection for the instance and the volume, and store the application's API token in a secrets store.